CVE-2022-24877 — Path Traversal in Fluxcd Flux2

CWE-22 — Path TraversalCWE-36 — Absolute Path Traversal5 documents4 sources
Severity
8.8HIGHNVD
CNA9.9
EPSS
0.6%
top 30.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Github.com Fluxcd Flux2Github.com Fluxcd Kustomize-controllerFluxcd Flux2+1 more
Timeline
PublishedMay 6
Latest updateAug 21

Description

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 a…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages5 packages

▶NVDfluxcd/flux2< 0.29.0
▶CVEListV5fluxcd/flux2flux2 < v0.29.0, kustomize-controller < v0.24.0+1

🔴Vulnerability Details

4
OSV
Improper path handling in kustomization files allows path traversal in github.com/fluxcd/flux2↗2024-08-21
▶
CVEList
Improper path handling in kustomization files allows path traversal↗2022-05-06
▶
GHSA
Improper path handling in kustomization files allows path traversal↗2022-05-04
▶
OSV
Improper path handling in kustomization files allows path traversal↗2022-05-04
▶
CVE-2022-24877 — Path Traversal in Fluxcd Flux2 | cvebase